I am dedicated to working closely with the open source community and with projects that are affected by a vulnerability, in order to protect users and ensure a coordinated disclosure. When I identify a vulnerability in a project, I will report it by contacting the publicly-listed security contact for the project if one exists; otherwise I will attempt to contact the project maintainers directly.

If the project team responds and agrees the issue poses a security risk, I will work with the project security team or maintainers to communicate the vulnerability in detail, and agree on the process for public disclosure. Responsibility for developing and releasing a patch lies firmly with the project team, though I aim to facilitate this by providing detailed information about the vulnerability.

My disclosure deadline for publicly disclosing a vulnerability is: 90 days after the first report to the project team.

I appreciate the hard work maintainers put into fixing vulnerabilities and understand that sometimes more time is required to properly address an issue. I want project maintainers to succeed and because of that I am always open to discuss my disclosure policy to fit your specific requirements, when warranted.

I believe that sharing a disclosure policy with maintainers is the first step to a smooth collaboration and I encourage all vulnerability reporters to do so. If my disclosure policy resonates with you feel free to copy it and use it for your own disclosures.

Please contact me at me AT codesalat DOT dev if you have any questions about my disclosure policy or my security research.